1. How this Annex fits
1.1 This Annex is an annex to Cloud Alter Inc.'s Data Processing Agreement (the "DPA") for the SMS service, under DPA 16. Words defined in the DPA, the Terms of Service (the "Terms") or the SMS Service Schedule (the "Schedule") mean the same here. If this Annex and the DPA differ, this Annex applies, unless the Standard Contractual Clauses (SCCs) or UK Addendum require otherwise.
1.2 For the SMS service, this Annex replaces DPA Annexes 1, 2 and 3, including for the SCCs and UK Addendum: its sections 2, 8 and 7 complete SCC Annexes I.B, II and III. The paragraph in DPA Annex 1 headed "For the SCCs (Annex I.A and I.C)" still applies. This Annex also replaces DPA 6.2(3), 6.3, 8.2, 12.1 and 12.2.
1.3 As DPA 2.1 says, you control the personal data in your installation and we process it for you.
1.4 DPA 2.2(c) applies narrowly to the SMS service. In routine operation, only what section 6 lists leaves your installation for our systems. We use traffic metadata for our own purposes only to investigate a credible abuse complaint, suspected fraud or a Security Incident, to answer a lawful traceback request or an authority's demand, or to establish or defend legal claims.
1.5 Your own account, contact, billing and tax details are our own records, covered by our Privacy Policy and not by this Annex.
2. Details of the processing
| Item | Details |
|---|---|
| What we do | Host and operate your installation, which accepts, prices, routes and sends SMS, handles delivery receipts, keeps billing records, and backs up if you buy the add-on; monitor and support it |
| Why | To provide, secure and support the SMS service on your instructions (DPA 4). We do not sell this data, use it for advertising, or use it to train AI models |
| Whose data | People messages are sent to; people named in messages; your customers' contacts; your staff |
| What data | Phone numbers and sender IDs; message text; message records and receipts; your customers' contact names, emails and allowed IP addresses; your staff's names, emails, sign-in addresses and recorded actions |
| Sensitive data | None intended; DPA 3.2 applies |
| How often | Continuously |
| How long | The Term and the periods in sections 4 and 9 |
3. Where the data is
3.1 Your server is in the DigitalOcean region you choose when you order, recorded with its country in your order. A restored server stays in that region.
3.2 Backups, if you buy the add-on, are in the region you choose for them.
3.3 Our systems run on DigitalOcean. The monitoring hub is in Singapore and the Cloudfonica portal, including support tickets, is in the United States.
3.4 Our staff who operate and support the service are Cloud Alter employees in Bangladesh and India, and may reach your data remotely from there. We give at least 15 days' notice before adding staff in another country.
3.5 Transfers: DPA 11 applies. You give the notices DPA 3.1(b) requires. You decide whether any local rule, such as a data-localization rule, allows your chosen region and this remote access.
4. How long data is kept
| Data | Kept for |
|---|---|
| Phone numbers, sender IDs and any stored message text, in message records and receipts | Cleared after 30 days by default; your staff can set 7 to 90 days. A country prefix stays for reports. Billing entries still awaiting a decision keep them until resolved |
| Logs | Rotated by date or size, normally within 30 days. Detailed logs your staff or our support switch on: 7 days |
| Billing records, without phone numbers or text once the period above has passed | 6 months by default, or another period your staff choose in the portal within the limits it shows (until automatic expiry ships in an update, kept until the installation is deleted) |
| Staff actions, support sign-ins and change reports | About 13 months |
| Backups (add-on only) | The last 7 nightly copies and the changes since |
| Copies taken during an update | Until the update is confirmed, or 7 days after a rollback |
| Health reports and alerts in our hub | Up to 90 days |
| Daily reconciliation counts in our hub | Up to 13 months |
5. Who can see the data
5.1 Your staff can see all data in your installation.
5.2 Access to servers is limited to authorized Cloud Alter staff using key-based authentication, only to operate or support the service. They are bound by confidentiality (DPA 5).
5.3 Our support's portal sign-in is tied to a ticket, an incident or an automated check. Message text is hidden from it, and phone numbers are visible so it can trace failed messages. Its sign-ins and changes are recorded in your installation.
5.4 Our staff may use commercial AI tools to help diagnose a ticket or incident. These tools may see SMS engine logs, with phone numbers masked and no message text, and health figures. We do not give them your database, message text or detailed logs. We use them only under business terms that bar training on your data.
6. What leaves your installation
Your messages go to the suppliers you connect, and receipts go to the addresses your customers give. With the backup add-on, encrypted copies of your data go to backup storage. Otherwise, no message text and no readable phone number leaves your installation for our systems in routine operation. It sends our hub only: health reports every minute, including plan usage; alerts; daily reconciliation counts per supplier link; update and backup-storage status; and, while our support is signed in, each request's type and page pattern. A filter removes anything shaped like a phone number before sending.
7. Sub-processors
| Sub-processor | What it does | Data | Where |
|---|---|---|---|
| DigitalOcean, LLC | Hosts your server, backups and our systems | Everything in your installation; backups are encrypted first | The regions in section 3 |
| Anthropic, PBC; OpenAI, L.L.C.; Google LLC | AI tools our staff use (section 5.4) | Masked engine logs and health figures (retained briefly only if required for automated abuse checks under business terms) | United States, or another location under each company's business terms |
| Google LLC | Email and workspace relay for service notices and support correspondence | Your contacts' email addresses, notice text and emailed ticket content | United States and Google's global data-centre locations |
Changes follow DPA 7.3. Your suppliers, gateways and customers are not our Sub-processors (DPA 2.4).
8. Security
8.1 What we do:
- Each client has its own server and database, with no administrator access for the client, in DigitalOcean's physically secured data centres.
- A firewall allows only web, SMPP and administration ports, and this is checked from outside before go-live.
- The portal and HTTP API use HTTPS (TLS 1.2 or higher).
- Server administration uses SSH keys only, never passwords, with access revoked promptly when a staff role ends, and multi-factor authentication protects our cloud-hosting control panel.
- Authorized staff are bound by written confidentiality agreements and receive privacy and security training.
- Each installation has its own secrets, software releases are signed, and operating-system security updates are applied.
- Staff passwords are stored as cryptographic hashes, repeated failed sign-ins are blocked, and sessions expire.
- Customer passwords are generated by the system, IP allow-lists are available, and failed HTTP sign-ins are throttled.
- SMS engine logs leave out message text and mask phone numbers by default.
- Phone numbers and message text are cleared after the retention period.
- Backups (when purchased) are encrypted before leaving the server, and the key is kept off the server.
- Automated one-minute monitoring raises health and security alerts, backed by an incident-response plan.
8.2 What the service does not do at launch:
- SMPP connections are not encrypted. Use the HTTPS API where you need encryption in transit.
- Repeated failed SMPP sign-ins are not locked out automatically. Set IP allow-lists for your SMPP customers.
- Portal staff have no two-factor sign-in.
- SMPP and supplier passwords are stored in readable form so the engine can use them, and the server's disk is not separately encrypted at rest.
- Some logs can hold phone numbers until they rotate out: detailed logs your staff or our support switch on, and the log of searches in the portal. The test supplier's log also holds the start of test messages.
8.3 You are responsible for your side of security (DPA 3.3), including staff accounts, IP allow-lists and the settings your staff choose.
9. Requests, incidents and deletion
9.1 Individuals' requests: DPA 8.1 applies. Your staff can find a person's recent messages by number in the portal. There is no self-service tool to erase one person's data early or to export all data. We act on your ticket, at your reasonable cost if it takes more than minimal effort. An export of Customer Personal Data under the Schedule is free.
9.2 Security Incidents: DPA 9 applies, including notice within 72 hours of becoming aware. We become aware when our staff, reviewing an alert or report in Support Hours, establish with reasonable certainty that an incident has happened. An alert outside Support Hours is reviewed when they start.
9.3 Deletion: after non-payment, Schedule clause 11.4 applies. Otherwise, Schedule clause 12.2 applies. Backups are deleted with the server. DPA 12.3 and 12.4 apply. Our hub keeps its records for the periods in section 4, and we keep your account records as our Privacy Policy says.
A question about this document? Contact us.